On (05/05/15 18:10), Olivier wrote:
>Thank you Lukas,
>
>> >My question is : are jokers supported in the host attribute ?
>>
>> Answer is no.
>>
>> Although it shoudl not be difficult to implemennt it.
>> I would suggest to look into function sdap_access_host
>> in src/providers/ldap/sdap_access.c and function fnmatch
>> (or libpcre wich is already used by sssd)
>
>I think it's in function 'sdap_access_host', in the tests after
>host = (char *)el->values[i].data;
>
>I'm not a C expert but may use this :
I thought you volunteered to implement it.
I didn't noticed it's sssd-users list.
>http://www.gnu.org/software/libc/manual/html_node/POSIX-Regexp-Compilation.html
>http://www.gnu.org/software/libc/manual/html_node/Matching-POSIX-Regexps.htm
>
I meant
http://linux.die.net/man/3/fnmatch
http://www.pcre.org/original/doc/html/index.html
>But the whole testing process would need to be review to consider
>the whole host (except the potential starting '!' that still would need a
>specific
>process) as a regular expression : I suspect this not being as simple as
>that
>(for me at least).
>
>May be another way be to use a nis netgroup with pam_access and to add a
>HBAC
Netgroups are not supported in ldap_user_authorized_host either.
So it will not work.
Currently ldap_user_authorized_host is very simple.
It does exactly what it is described in man page.
If someone want to use for different purpose then new features need to be
implemented. Patches are always welcomed.
According to git the author of this feature is
commit 3612c73e7957721bcbf31d0118e2ac210eb46b88
Author: Pierre Ossman <pierre@ossman.eu>
Date: Wed Dec 22 22:29:03 2010 +0100
Add host access control support
https://fedorahosted.org/sssd/ticket/746
LS
_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users